T h e l i t t l e bo ok o f

Health and Safety

Management
for small businesses

Big
Business

Artizan
Hand Products
Made
Distribution
Warehouse
Contents
1. Introduction 3
2. Why do I need to manage health and safety? 4
3. What is an occupational health and safety
management system? 5
4. Where to start 6
5. One size does not fit all 8
6. Who cares? The people part 10
7. So, how do you do this? 12
8. Have you got a plan? 14
9. How do you do this? 17
10. Doing it - Operations 18 The chances are you didn’t think too much about health and safety when you
11. Keeping an eye on things 20 started your business. But people getting ill or hurt because of work is no good
12. Improvement / monitoring and measuring 22 for you, them, or the business. So it makes sense to look out for your people and
take a bit of time to really understand where the risks are and what you can do
13. Some things to watch out for 23
about them.
Managing health and safety doesn’t have to help protect the future success of your
be hard, expensive, time-consuming or involve business, too.
loads of paperwork. It’s easier than you think. This simple guide will help you get started
For many businesses, taking a few basic and introduces the idea of health and safety
practical steps may be all that’s needed to management systems.
protect people. And those same steps can
3
Why do I need
to manage health What is an

and safety? occupational health and safety

It just makes sense.
First off, we expect to make it home from work in the
same sort of shape as when we started the day.
management system?
It’s a framework for managing health and
Secondly: it’s the law. safety right across your business, instead
of dealing with one risk at a time. It gives a
Finally, healthy workers don’t go off sick and no injuries way of working that means plans, actions,
means no disruption. Simply speaking, a business that checks and improvements work together
looks after its workers’ health and safety gets more done. in a way that can be built into the general
day-to-day running of your business.
Health and safety management systems are
This booklet introduces many of the ways
of working set out in the international
standard known as ISO 45001, and can
help you decide if a formal management
system like that is right for you. Regardless
of whether you decide to go for a
management system that meets all of
the requirements in ISO 45001 or not,

The law
The basis of British health and safety law is the
Health and Safety at Work Act 1974.
This sets out the duty of care employers have to
employees and others that their work activities
could affect.
A really important part of UK law is the idea of
‘so far as is reasonably practicable’.
What does this mean? Basically, you don’t have to
break the bank to make sure no-one ever gets a
paper cut and you don’t need to make your
workplace tsunami-proof if you’re hundreds of
miles from the sea. If something is technically
impossible, or the time, trouble or cost is
completely crazy for managing a risk you’re
considering, the law doesn’t expect you to do it.
What the law requires is what good management
and a sound understanding of their business
would lead most employers to do anyway: look at
the risks and take sensible steps to tackle them.
adopting some of the ideas can help drive
not required by law. Some management
a positive, safe and healthy culture in your
system standards actually ask you to go
workplace.
beyond what the law requires - so it’s up to
you to decide whether going beyond basic
legal requirements is appropriate for your
business and if you will benefit from
implementing a structured management
system.

4 5
How do I do it?
Decide if you need extra help

Where to start?
There’s a world of jargon, acronyms, experts and schemes out there using
language that most normal people don’t speak. Don’t worry. It’s not as
hard as it seems. A health and safety management system can be simple Do what you say you’re going to do
and should be based on your own needs, no matter what type of business
you’ve got.
The basic framework of a health and safety management system asks you to:

ext – who rking

Understand your cont Check how well it’s wo
u do , where you
you are, what yo Take the lead on mak
ing your
get hurt
do it and who could workplace safe an d he althy,
rk er s inv olved
and get your wo Although a formal management
system requires that certain things are
documented, always remember that
it’s managing your risks well that’s
important, not the amount of paperwork
you create. What counts is how well you
Plan – decide what you need to k for ways are protecting people and keeping your
Fix problems and loo workers safe and healthy.
do and how you’re going to do it; u ar e doing even
to make what yo
more effective

6 7
One size does not fit all
Context is everything. Your situation is different from anyone else’s in one way
or another, and understanding all the different things that can affect you is the
key to getting health and safety management right.
Knowing your own situation is key to keeping your reflect this complexity. A smaller business is often
system simple and in proportion to the risks you’re less complex, so how its context and risks are
trying to control. assessed can be simpler, too. It’s important to
remember, though, that size isn’t everything.
For example, a multi-national organization can
Small businesses can be complex or high risk just
have different sites, departments and activities,
as large businesses can be simple or low risk.
and the processes used to identify issues probably

8 9
Who cares? The people part
All sorts of people have an interest in how you manage health and safety in your
business. Some are more important than others, but if they can affect what you
do, or you can affect their health or safety, you need to pay attention.
The most important group are your own workers. • Customers: once upon a time, customers might
Listen to them, talk to them and involve them in not have cared so much about how what they buy HSE (or the Health and Safety Executive) and
Local Authorities are the national health and safety
decisions about health and safety management. affects the people making or providing it. Today
These are the people with the most to gain – or lose they do. Businesses with a good health and safety
– and they may have a good understanding of the
risks they face day to day. They know what actually
record build a better reputation, and this always
appeals to the ethical consumer.
regulators for almost all workplaces in England,
goes on in the workplace. By getting them involved
• Insurers: they sometimes set specific conditions Scotland and Wales. They provide health and
you’re going to get buy-in and your system has a
much better chance of working well.
for managing health and safety and might look for safety guidance, inspect workplaces and when
necessary investigates serious incidents. They may
evidence of how you’re meeting those conditions.
There are also other possibly less obvious groups
• Regulators: depending on what your business
who really matter:
does, you might get a visit from a Health and also take enforcement action against those who
• Your supply chain: sometimes contracts ask for
evidence that you are managing your health and
Safety Executive (HSE) or Local Authority
regulator; they may consider your management have not complied with the law. LAs regulate
safety, whether through a recognised standard system when looking at how you’ve demonstrated workplaces in retail, wholesale distribution and
warehousing, hotel and catering, office work, and
like ISO 45001 or through other evidence (e.g. compliance with health and safety law
sector schemes, policies or processes). On the flip
side, you are more likely to be seen as a good
business to work with if you’re seen to care about
the consumer/leisure industries. Otherwise, with a
the health and safety of your contractors and take
the time to involve them in managing risks.
very few exceptions HSE is the regulator.

10 11
So, how do you do this?
In a small business the easiest way to get people involved is to talk to them.
Ask questions, listen to the answers, encourage suggestions and feedback.
Make sure people know it is okay to talk about When it comes to your supply chain and other
things that can – or have – gone wrong. people outside of your business don’t assume you
know what their needs, wants and expectations are.
Get people trained so they know what is and
isn’t safe or could make them ill and what to do Check:
if someone gets hurt or becomes ill. Get online visit their websites,
and make use of the free advice from reputable pick up the phone, or
sources (e.g. the national health and safety arrange a meeting
regulator, the Health and Safety Executive (HSE)) – whatever works best for both sides.
If that doesn’t meet your needs, you may need
And don’t forget to stay in touch.
to consider more formal training.
None of this is a one-time thing. Needs and
And don’t forget those workers who aren’t actually
expectations change and so do the people
in the building when you talk about things. People
involved, so keep an eye out and keep talking.
based at home, people on the road, the night shift:
everyone should be part of this conversation. So
use the wonders of modern technology: set up a
What’sApp group, use social media pages, email,
conference calls. It doesn’t matter how you do it,
so long as it works. And don’t forget, this can be
part of the ‘paperwork’ that demonstrates your
management system is working.

12 13
 The law s
Have you got a plan? tates that
than five employe
if you hav
e
es, you don’t havfeewer
The goal of health and safety management is to protect people; to do this well
you need to break it down into exactly what you want to achieve, who’s going
to write down your health and
to do it, how and by when. You, as the boss, should take responsibility, set a
policy. Simply being able to
direction and make sure there is someone with the right skills, knowledge safety enough
and experience to help you lead the way.
icat e it is
The people at the top of your business – the So, that means you can:
commun
owners, senior managers, big decision makers – • do this yourself,
need to take health and safety seriously and be •g et one or more of your workers to take
seen to be doing that. If it’s at the heart of how on the role; or
your business is run, your workers will know it • fi
 nd someone from outside your business –
matters and a positive culture will develop. or all three if you need to.
The law states that as an employer, you must If you do decide that you need external advice (e.g. Describing how you’ll manage health and safety For a management system to effective, your
use someone ‘competent’ to help you meet your if you have to manage complex risks), the most in your business will let your staff and others workers not only need to be aware of it, they need
health and safety duties. A competent person is reliable source of good-quality health and safety know about your commitment to health and to understand what it’s trying to do, how it affects
someone with the necessary skills, knowledge advice is the Occupational Safety and Health safety. This is called your health and safety policy. them and how they can affect it.
and experience to advise what you have to do Consultants Register (OSHCR).
Your policy doesn’t need to be complicated or You’ll also need to make sure your workers are
to manage health and safety. But this doesn’t
time-consuming. To help you, HSE has created made aware of relevant hazards and related risks

th
necessarily mean external expert advice.

a h eal
templates you can download and complete. HSE that can cause injury or ill-health.

“Yo u’ll n eed also provides an example health and safety policy
to give you an idea of what to include.
Think about what, in your business, might cause

y ”
harm to people, and decide whether you’ve done

a nd sa fet y po lic A policy will only be effective if you and your

workers follow it, and you keep it up to date,
so that it stays relevant as things change.
enough to prevent or minimise the chances of
that harm happening. This is known as managing
your risks, and starts with risk assessment. You’re
probably already taking steps to protect your
Making it too hard is likely to be counter-
workers, but a risk assessment will tell help you
productive - keep it realistic and achievable.
work out if you need to do more.
14 15
 The law states that if you have fewer than five
employees you don't have to write anything

How do you do this?

down – but you’ll still need to be able to explain
your risk assessment to anyone who needs to
know, especially employees.

A good starting point is to walk around your workplace, talk to your staff and
look for anything that can harm people – the hazards. Then think about the risk
– what are the chances (high, medium, low) of somebody getting hurt or being
made ill by each hazard - and how serious the harm would be.
A management system should concentrate on to include the risks you (or your ‘competent person’)
the ‘real’ risks – those that are most can reasonably be expected to know
likely to cause injury or ill-health. about.
Once you’ve identified the Any paperwork or electronic
Medium
risks and looked at the record you produce should
various ways you can help you manage your
control them, you should risks and let other people
put the appropriate know about them. HSE
measures in place. has created material to
Assessing risks doesn’t have to involve huge help you, including an

Low
You aren’t expected to

High
amounts of paperwork. It’s just about identifying online risk assessment
sensible ways to control the risks in your remove all risks (that
tool and example risk
workplace. would be impossible)
assessments.
but you should
You should record the more serious things control them so far as And don’t forget, when
whether on paper or on your computer or reasonably practicable you’re planning changes,
wherever suits you, but don’t worry about (remember that phrase? to consider ways of
recording all of the smaller, everyday risks. We used it earlier – see page 8). improving health and safety.
Keep it simple and focus on controlling the risks. Your risk assessment only needs

16 17
Doing it - operations
A health and safety management system asks you to apply a ‘hierarchy
of controls’ when looking to control your risks.
What is a ‘hierarchy of controls’?
Sounds technical but isn’t!
It’s a step by step way of either getting rid of
hazards (things that can hurt people) completely or
reducing the chance of something bad happening
or how much they can hurt someone. The best
thing to do is to get rid of the hazard altogether.
The hierarchy of controls, explained.
Type of control Example
hazard elimination buying pre-cut building materials instead of cutting on-site;
Depending on what your business does, you might
also need to think about how you buy products and substitution swapping the dangerous for safe or less dangerous; e.g. using water-
services and how that can affect the health and based paint rather than solvent-based paint,
safety of both your own workers and the people engineering controls putting guards on machine or using local exhaust ventilation
providing them when they are in your workplace. systems;
administrative controls using standard operating instructions or rotating work and workers
to reduce effects such as repetitive strain injuries, or loss of

This is at the top of the hierarchy. Underneath that
are other things you can do - each step down the
list is less effective than the one above it, but using
several of the steps at the same time can often
reduce risks well.
It’s important to remember that things change.
Trained staff might leave, you might change
premises, or you might start making new products
or introduce new ways of working. You need to
make sure you are on top of these changes and
how they affect your risks and then think about
whether how you manage those risks still works.
18
NEW
concentration due to boredom;
PRO personal protective safety shoes, hearing protection
DUC equipment (PPE)
T
It’s important to understand that different
businesses or contractors will manage health and
safety in different ways – it’s all about context,
remember (see p8). So be careful not to demand
too much or to expect other people to do things the
same way that you do. Making sure that the risks
are managed is what is important, not a particular
system or way of doing things.
Remember too, that some changes in the workplace
can change your risks – e.g. machinery supplied to
you or contractors working on your site – but you
only need to do something different if the change
really increases the risk.
You’ll also need to think about what happens if
someone does get ill or hurt. Do you have a first aid
kit? Do your workers know what to do if something
happens? Who takes charge? Who should be told
about it? Do you need make a formal report under
accident reporting laws (RIDDOR) or due to other
requirements, for example a contract?
If your business is complex or high risk, you might
need to think about developing a formal response
plan which people know about, can find and fully
understand.
19
Keeping an eye on things
As the boss, you should know what’s going on. planned to do, check it’s working, take action if it’s
not. And remember that this is not something you
How do you know if things are going well - or
do just once. It’s a cycle that you should repeat,
badly? Do you just feel it in your bones, or do you
as and when you need to.
have evidence to back those feelings up?
It’s not as much work as it sounds: we all live this
The chances are that you already have ways of
way all the time. Whether it comes to what we are
checking the important stuff, whether it’s financial
going to eat, or how we are getting to work, or how
targets or health and safety performance – but it
we go about saving for something. Think about it -

Health and Safety Performance

pays to have a proper system in place to check
if you had a meal that you didn’t enjoy, you wouldn’t
how you are doing regularly.
just have the same thing again. You’d automatically
A management system is based on a simple circle. do something different next time.
Plan. Do. Check. Act. Plan ahead, do what you

Artizan
Products

JAN

FEB

MAR

APR

MAY

JUN

JUL

AUG

SEP

OCT

NOV

DEC
20 21
Improvement / Monitoring and measuring Some things to watch out for
This needn’t be hard work - just do what works for you.
In some businesses measurement has to be
Just look for ways you can improve health and safety
at work. If it’s practical and affordable – and will Common failings
precise, recorded and regularly reviewed, e.g. actually make a difference – give it a go. It could be
Job done
if you’re dealing with chemicals, explosives, or as simple as getting the first aider to share what they
nd g
potentially dangerous manufacturing equipment. know with other workers or adding health and safety On the grou rop o rtion. Remem
ber, managin
g yo ur
Thinking that things will never change, or
gs out o f p derstan din that having established a management
In other businesses, like an office or small shop, it to team meeting agendas.. Getting thin is o ften just about un an ag em en t system, it’s “job done”. Always remember
fety . If your m
can be less exact. At home, we all know what it’s
It can be helpful to stand back once in a while health and sa m o n sen se at’s
like to monitor progress against plans as we go d using com nnected from is!
wh that a management system is a cycle:
from the day-to-day and take a long hard look at business an co m plex or disco b ab ly Plan. Do. Check. Act. And keep on doing
about our day to day activities (how’s the washing els to o it pro
your business from every angle. Get a big picture system fe ‘o n the gro und’ – then those things.
g on
doing, will the dinner be cooked in time for when
view of those things you’ve been measuring, and actually goin
the kids get in?).
do some cross-checking. What does the evidence
Doing it for health and safety is just the same. tell you? Is your system working? Are you Complicated paperwork
It makes sense to monitor things as a matter of managing your risks well enough? Having complicated paperwork that doesn’t reflect health
and
routine (are spills cleaned up quickly and properly? safety on the ground. It has to work with your business;
Ask questions. Listen to the answers.
Are people wearing their safety goggles? Is the otherwise it’s just wasting time and money.
Ask people’s opinions.
mood in the workplace good or are there signs Expert advice
of stress? But you only need to measure what’s And think: when something went wrong (any near
important. Are the rules being followed? Are miss accidents, any patterns or clusters of illness Believing you need ‘expert advice’: you It's voluntary
accidents being reported? Are there more of them or injuries), was it avoidable? Did you put things may not. In low risk environments, more
Thinking that you have to use standards.
or less? Are they serious or minor? Do we have right quickly, effectively and to the satisfaction of often than not you or someone in your
They’re voluntary, not the law. It’s for you
a problem with long-term sickness absence? those affected? Did you put something in place to own business is best placed to do this.
to decide if it works for you
stop it happening again?
Continual improvement?
Doing this helps you think in a focused way about
Continual improvement is the ‘act’ part of the
cycle that management systems are based on things you can do to improve and to make sure Assessment
(remember Plan-Do-Check-Act?). This doesn’t mean your management system is working.
Thinking that a management system standard is the only
you need to change things that are working or way to
show other people, such as customers, that you are on
constantly worry about putting in some new top of health
and safety in your business. For low risk activities a health
health and safety rule. and
safety policy and/or a risk assessment can often be enoug
h.
22 23
Taking things further
This document provides information on the basics of
good health and safety management. Further advice
on this and what the law requires is available on HSE’s
website at http://www.hse.gov.uk/abc/index.htm.
If you like the idea of using a standard like ISO 45001
to help you manage your health and safety but have
never done this sort of thing before, take it slowly
and get to grips with who’s who and what’s what.
Just remember, even if you decide to give ISO 45001
a go, you don’t need to meet all the requirements at
once, you don’t need to change everything you
already do and you don’t need to rush into
certification.
Below is an explanation of some of the terms used
in the world of standardization to help you
understand better.
Certification
Getting a certificate means an outsider (auditor)
comes into your business and checks you are doing
what you say you are doing. If you say you are
meeting ISO 45001 requirements the auditor will use
those requirements to check against. If you pass the
audit, you get the certificate. If you’ve missed
something or something is going wrong, you’ll be told
there is a nonconformity. Fix it. Get it re-checked.
Then you’ll get your certificate.
Accreditation
People confuse certification and accreditation.
You can’t be accredited to ISO 45001, you can only be
24
certified. The certification body (CB) that audits you
can be accredited. This means they’ve been checked
over and carry out audits the way they are meant to.
Most countries have a national accreditation body. In
the UK this is UKAS.
If you get certified by an accredited certification body,
your certificate is likely to mean more than if you use
a ‘pay us and we’ll email you a certificate’ certification
body. Remember – this is about bringing benefits to
you and your workers, not the bit of paper on the wall.
National standards bodies
Almost every country in the world has a national
standards body (NSB). These are where official
national standards come from: NSBs work with
industry, academia, government, workers
representatives and many others to develop
standards. Most NSBs are also a member of ISO,
the international standards organization, and work
with experts from all over the world to write global
guidelines and requirements like ISO 45001.
In the UK the national standards body is BSI.
This part of BSI is independent: it doesn’t have
shareholders and isn’t part of government. Anyone
can come to BSI for independent information on
standards.
Auditors
Certification bodies use auditors. These are
people trained to come out and assess your
business. You can also use people in your own
business to do your own checks.
FAQs
What is a standard? Do I have to get certified?
A standard is a set of requirements or guidelines No. Putting a health and safety management system
written by industry and subject experts. Everything in in place will bring benefits whether or not you have
a standard is agreed by the experts as well as put out certification. You don’t even have to meet all of the
for public consultation. Standards reflect current requirements to start seeing a benefit. The standard
good practice. A standard is not a law – you can is just a framework: use it in the way that suits you.
choose to use it or not.
Why would I get a certificate?
Is using ISO 45001 going to cost me Certification gives you a recognized way of showing
lots of money? you are taking steps to protect the health and safety
of your workers. It can give confidence to employees,
Getting certified does mean costs, but putting in an
customers, suppliers and contractors and helps drive
ISO 45001 based system is mainly going to take time
OH&S improvement.
and thought. You can buy the standard from the BSI
shop or read it for free at a library. Either way, the
benefits should outweigh the cost in the long run.
How is it going to help me when there
are only five of us in the company?
It doesn’t matter if you have one person, five or half a
million: a system is likely to make your business safer,
healthier and more productive. The simpler your
business the easier it is to put in a system that works,
so only having five people when you start might be
an advantage.
25
Further reading
Free information on managing health and safety,
and on ISO 45001, is available from all sorts of
places. There are also a lot of discussion groups on
sites like LinkedIn, where users ask and answer
questions and debate issues. One note of caution:
anyone can write guidance and publish online and
sometimes people get things wrong or are pushing
a particular agenda. It pays to be careful of what is
fact and what is opinion. It’s best to start with
more official views from HSE, BSI or ISO.
The standards themselves
The standards can be bought from the BSI shop
or directly from ISO. If you want to read before
committing hard cash ask your local library to
get you read-only access.
ISO 45001:2018 Occupational health and safety
management systems – requirements with
guidance for use
This is the key standard. It gives requirements that
can be used as a tool for setting up and checking
own system and is also used for external audits if
you go for certification.
BS 45002-0:2018 Occupational health and safety
management systems. General guidelines for the
application of ISO 45001.
Simple, clause by clause guidance on how to meet
the requirements of ISO 45001.
26
BS 45002-1:2018 Occupational health and safety
management systems – General guidelines for the
application of ISO 45001. Guidance on managing
Notes
occupational health.
A plain language introduction to managing the
health side of the equation, containing practical
examples and links to further reading.
BS 45002-2:2019 Occupational health and safety
management systems. General guidelines for the
application of ISO 45001. Guidance on managing
risks and opportunities
A simple guide exploring how businesses of all
sizes can manage risks and opportunities relating
to OH&S and an OH&S management system.
BS 45002-3 Occupational health and safety
management system – General guidelines for the
application of ISO 45001. Guidance on incident
investigation.
Simple, step-by-step guidance on investigating
workplace health and safety incidents, focusing on
understand why things happen and putting in
measures to avoid it happening again.
HSG 65
This is HSE’s guide to implementing a health
and safety management system, and is free
to download and use.
27
Thanks
This guide to health and safety management was developed by
UK experts from HSE, BSI and Lloyd’s Register.

shop.bsigroup.com/45001